grype
grype copied to clipboard
WIP: narrow golang match comparison for pseudo versions
Summary
This PR attempts to narrow the golang_constraint Satisfied
logic as a follow up to #1797
#1797 allows grype to proceed with matches when it encounters a package with a pseudo version
. This PR limits those pseudo versions to only be compared against constraints that also contain pseudo versions.
This eliminates a case of FP where an incomplete pseudo version
(which doesn't have the correct main module information) is compared against a valid semver constraint.
Example of this FP:
syft -o json ollama/ollama:0.1.32 | go run cmd/grype/main.go
...
github.com/ollama/ollama v0.0.0-20240414223325-7027f264fbb3 0.1.29 go-module GHSA-5jx5-hqx5-2vrj High
In the above case v0.0.0-20240414223325-7027f264fbb3
is not < 0.1.29
. Syft is unable to determine the main module version for ollama. By comparing the incomplete pseudo version to the semver constraint grype produces a FP.
This PR makes it so that packages with versions like v0.0.0-20240414223325-7027f264fbb3
should only be compared to constraints that also have a similar format.
Quality tests are now failing - let me go check the labels